The FCA Mills Review: What It Means for UK Financial Services and AI Adoption

On 6 July 2026 the Financial Conduct Authority published the Mills Review — the first review of its kind launched by a financial regulator anywhere in the world — setting out how artificial intelligence, and increasingly agentic AI, will reshape UK retail financial services by 2030 and beyond. Led by FCA executive director Sheldon Mills, the review identifies four AI-driven shifts, makes seven priority recommendations to the FCA Board, and signals a clear regulatory direction: no new AI-specific rulebook, but a materially higher bar on governance, oversight and evidence. This guide explains what the Mills Review says, what it means for financial companies in London and across the UK, and how to turn its findings into an AI adoption plan you can defend to a regulator.

By Toni Dos Santos, Co-Founder, Spicy Advisory

What Is the Mills Review?

The Mills Review — formally AI and the future of retail financial services — is an independent review commissioned by the FCA Board and led by Sheldon Mills, the FCA's executive director for consumers and competition. Published on 6 July 2026, it builds on an Engagement Paper issued in January 2026 and draws on evidence from firms, trade bodies, consumer groups, technology providers and international regulators. The FCA describes it as the first work of its kind initiated by a regulator anywhere in the world.

Its purpose is forward-looking rather than rule-making: to map how AI could transform retail financial services — for consumers, firms, markets and the regulator itself — between now and 2030 and beyond, and to recommend how the FCA should adapt. As Sheldon Mills put it, “Artificial intelligence will transform financial services by 2030. It creates significant opportunities for consumers, firms and the wider economy.” You can read the full report on the FCA's website.

The review lands in a specific UK regulatory context. Britain has chosen a principles-based, outcomes-focused path on AI — leaning on existing frameworks such as the Consumer Duty and the SM&CR rather than an EU AI Act-style horizontal law. If you are weighing the two approaches, our explainer on UK vs EU AI regulation and our guide to the Data (Use and Access) Act set out the wider landscape the Mills Review sits within.

The Four Shifts the Mills Review Identifies

The review's central analysis is that AI will drive four structural shifts across retail financial services. Each is an opportunity and a risk at the same time.

Two of these deserve particular attention for UK firms. The operations shift is where most of the near-term productivity is — the kind of reporting, forecasting and analysis gains we detail in our guide to AI for finance teams. The fraud-and-cyber shift is where the review is most cautionary: as agentic systems proliferate, so does the attack surface, which is why shadow AI and security posture can no longer be treated as side issues.

The Seven Priority Recommendations

The review sets out seven priority recommendations for the FCA Board and Executive to consider. Crucially, these are recommendations to the regulator about how it should adapt — not a new compliance checklist imposed on firms. But each one signals where supervisory attention is heading.

Recommendation 6 is a genuine first: the FCA envisages agent-to-agent supervision, where its own supervisory agents triage firm submissions, test evidence against expectations and generate information requests. In practice that means the quality and machine-readability of the evidence you hold about your AI systems will increasingly matter.

Agentic Finance: 11 Million UK Adults and a Market Moving Fast

The defining theme of the Mills Review is agentic AI — systems that don't just answer questions but take actions autonomously within goals a person sets. FCA-commissioned research found that a fifth of people, equivalent to around 11 million UK adults, are likely to use AI that can act on their behalf within pre-set limits — booking, switching, paying, managing money. The same research flags real consumer anxiety about trust and control, which is precisely why the FCA wants guardrails in place before adoption scales.

Industry data shows why the regulator is moving now rather than later. Research by the Payments Association found that 58% of UK online merchants believe AI agents have already transacted on their platforms, yet only 41% are confident in the liability frameworks governing those transactions — adoption is outrunning the plumbing. Zoom out and the trajectory is unmistakable: analysts value the global agentic-AI-in-financial-services market at roughly $7.8 billion in 2026, up from about $5.5 billion in 2025, with projections above $40 billion by 2031 — a compound growth rate north of 40%. The UK segment alone is estimated in the region of $0.66 billion for 2026. Cambridge's 2026 Global AI in Financial Services study puts around 52% of financial-services respondents in active agentic-AI adoption, with fintechs ahead of incumbents (roughly 57% vs 45%). On returns, KPMG has reported an average 2.3x return on agentic-AI investment within 13 months, and McKinsey has documented 20–60% productivity gains in use cases such as credit analysis. If you want the practical mechanics, our guide to building production-ready agentic workflows shows what “safe and governed” actually looks like.

What the Mills Review Means for UK Financial Firms

The single most important takeaway for compliance and leadership teams is what the review doesn't do: it does not create a new AI rulebook. Instead, it confirms that the UK's existing, principles-based framework will stretch to cover AI — and quietly raises the bar for how firms evidence that they are meeting it. Three implications stand out.

1. The Senior Managers Regime still applies — and gets sharper. The review is unambiguous that the SM&CR accountability model continues to hold as AI systems become more autonomous. Notably, no firm argued that it should change. Firms remain answerable for AI-driven outcomes, and the review recommends clearer guidance on the “reasonable steps” senior managers must take as they delegate more to AI. In other words: you can delegate the task to an agent, but not the accountability.

2. The Consumer Duty is the lens. AI-driven journeys still have to deliver good outcomes, avoid foreseeable harm and treat customers fairly — whether the interaction is with a human, a chatbot or an autonomous agent. That makes explainability and outcome-testing operational necessities, not nice-to-haves.

3. The evidence bar rises. With the FCA planning AI-enabled supervision, firms will increasingly need clean, current, machine-readable evidence of how their AI systems are governed, tested and monitored. Getting your AI governance framework and your data and security posture in order — the ground covered in our CISO's guide to enterprise AI security — is now a supervisory expectation, not a maturity badge. The FCA has also said it will follow the review with guidance on good and poor AI practice later in 2026.

Our Perspective: The Shift to Agentic Is a Governance Shift, Not Just a Tech Shift

At Spicy Advisory we read the Mills Review as confirmation of something we see every week inside UK financial firms: the move to agentic AI is far less about the technology than about the operating model around it. When AI was an assistant that drafted an email or summarised a document, a human always sat between the model and the outcome. Agentic AI removes that human from the loop by design — the agent acts. That is exactly where accountability, consent and liability stop being abstract and start being daily operational questions.

The market data makes the timing non-optional. When a fifth of UK adults say they will let AI act on their behalf, when most financial-services firms are already piloting agentic use cases, and when analysts expect the market to grow more than fivefold this decade, “wait and see” becomes the expensive option — the same dynamic we described when UK AI adoption crossed its tipping point. But moving fast without governance is worse than moving slowly: an ungoverned agent that acts is a regulatory incident waiting to happen.

Our view is that the winners will be the firms that treat the Mills Review as a prompt to build three things in parallel: capability (people who understand what agentic AI can and cannot safely do), controls (governance, human-in-the-loop checkpoints, audit trails, named SM&CR owners), and credible use cases (a small number of high-value workflows delivered with guardrails and measured). Tools are the easy part. The capability and the controls are what put you on the right side of the regulator — and the market.

What Financial Companies in London and the UK Should Do Now

You don't need to wait for the FCA's follow-up guidance to move. The review's direction is clear enough to act on today. Here is the sequence we recommend to financial firms — from London challenger banks and wealth managers to insurers, brokers and fintechs across the UK.

1. Inventory your AI — including the shadow AI. Map every AI and agentic tool in use, sanctioned or not. Most firms underestimate this by a wide margin; unmanaged tools are where both risk and untapped value hide.
2. Map each material use case to an SM&CR owner. For every AI system that touches customers or decisions, name the senior manager accountable and document the “reasonable steps” they can point to.
3. Raise the governance bar to the review's standard. Explainability, outcome-testing against the Consumer Duty, human-in-the-loop checkpoints for autonomous actions, and clean, machine-readable audit trails — anchored in a practical governance framework.
4. Upskill the people, role by role. Compliance, risk, advice, operations and leadership each need different AI fluency. Generic webinars don't change behaviour — role-specific, workflow-based training does, as we set out for regulated teams in AI training for UK financial services.
5. Pilot agentic use cases inside guardrails. Pick two or three high-value, lower-risk workflows, give each an owner and a metric, and use the FCA's AI Lab and sandboxes where relevant.
6. Measure and scale deliberately. Track hours saved, turnaround time, error rates and customer outcomes, then extend what works — the staged approach in our UK adoption roadmap.

How Spicy Advisory Helps UK Financial Companies With AI Adoption

Moving from “we use AI” to “we use AI safely, systematically and in line with the FCA's expectations” is exactly what we do. Spicy Advisory works with financial firms in London and across the UK at three levels:

• AI & agentic readiness audit. We diagnose where your firm actually sits — current and shadow AI usage, governance and SM&CR gaps, and the two or three workflows where AI pays back fastest and safest. Start with the free self-audit or a free audit call.
• Role-based AI training for regulated teams. Hands-on, workflow-based AI training for financial services — compliance, risk, advice, operations and leadership — built around your approved tools and real processes, delivered across the UK including in person in London and nationwide.
• Adoption, governance and agentic strategy. AI strategy consulting to design the operating model the Mills Review implies — governance, human-in-the-loop controls, prompt and evidence libraries, champions and metrics — with on-the-ground support in London.

We don't resell tools and we don't run awareness theatre. We build the capability and the controls that put your firm on the right side of the regulator — and the market — as agentic finance arrives.